Multi-Node Edge Ingress: Configuring Cloudflare Full SSL/TLS, Authenticated Origin Pulls, and Nginx

Putting a domain behind Cloudflare CDN does not automatically protect your origin servers if attackers can discover and connect to your origin IP directly. Securing multi-node edge ingress requires mutual TLS (mTLS) origin validation and strict firewall boundaries.

1. The Danger of Direct Origin Access (Bypass Attacks)

If your origin Nginx server accepts connections from the public internet on port 443, attackers can scan IPv4 space or inspect historic DNS records to locate your server IP. Once discovered, they can bypass Cloudflare's WAF and DDoS mitigation rules entirely.

2. Cloudflare Authenticated Origin Pulls (mTLS)

Authenticated Origin Pulls ensure that your origin server strictly accepts incoming HTTP requests that present a valid cryptographic client certificate signed exclusively by Cloudflare's Certificate Authority.

# Nginx configuration for Cloudflare mTLS Origin Authentication
server {
    listen 443 ssl http2;
    server_name dreamvfia.com;

    # Origin SSL Certificate (Signed by Cloudflare Origin CA)
    ssl_certificate /etc/ssl/certs/cloudflare_origin.pem;
    ssl_certificate_key /etc/ssl/private/cloudflare_origin.key;

    # Enforce Cloudflare Client Certificate Verification
    ssl_client_certificate /etc/ssl/certs/cloudflare_origin_pull_ca.pem;
    ssl_verify_client on;

    # Hardened TLS Protocols
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    location / {
        root /var/www/dreamvfia-com;
        try_files $uri $uri/ /index.html =404;
    }
}

3. Summary

With ssl_verify_client on;, any attempt by an external actor or scanner to reach the origin server directly over HTTPS is instantly terminated at the TLS handshake phase with 400 Bad Request: No required SSL certificate was sent.